Currently, we only count the total number of LDAP referrals chased during a given operation and only log when we begin a connection attempt to a referred server.

We should group the referral count by "success" vs. "failure" and add additional logging when a referral fails, along with the reason why (e.g., TLS handshake failure). This will help TSEs easily identify where an LDAP operation failed if the query involved numerous referrals in a large AD forest, for instance.